{"id":"CVE-2016-1646","kind":"vulnerability","aliases":["CVE-2016-1646"],"related":[],"title":"The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before…","description":"Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.\n\nCISA required action: Apply updates per vendor instructions.","summary":"The V8 JavaScript engine in Chromium-based browsers has an out-of-bounds read that a crafted web page can trigger. An attacker can crash the browser or possibly achieve other unspecified impact, and it is listed as exploited in the wild.","severity":"critical","cvss":9.3,"epss":0.4811,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"Google Chromium V8","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 14.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 15.10","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 16.04","ecosystem":"vendor"},{"name":"google chrome","fixed":["49.0.2623.108"],"affected":"< 49.0.2623.108","ecosystem":"vendor"},{"name":"suse package hub","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"opensuse leap","fixed":[],"affected":"= 42.1","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 13.1","ecosystem":"vendor"},{"name":"redhat enterprise linux desktop","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 6.7","ecosystem":"vendor"},{"name":"redhat enterprise linux server","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux workstation","fixed":[],"affected":"= 6.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browsers","chromium","exploited","google-chrome","microsoft-edge","opera","runtime"],"not_affected_if":["fully-patched-browsers","js-disabled"],"how_to_check":null,"fix":"Update Chrome, Edge, Opera and other Chromium-based browsers to a release that includes the vendor fix; the sources do not give the fixed version.","status":"open","published_at":"2016-03-29T10:59:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:48+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:12:48Z","model":"claude-haiku-5-5","output":{"fix":"Update Chrome, Edge, Opera and other Chromium-based browsers to a release that includes the vendor fix; the sources do not give the fixed version.\nunknown","reach":"internet","impact":"high","summary":"The V8 JavaScript engine in Chromium-based browsers has an out-of-bounds read that a crafted web page can trigger. An attacker can crash the browser or possibly achieve other unspecified impact, and it is listed as exploited in the wild.","category":"runtime","who_cares":["chromium","google-chrome","microsoft-edge","opera","browsers"],"confidence":0.6,"needs_auth":"no","worst_case":"Browser crash, or possibly code execution via a malicious web page","analyst_note":"Confirm fixed Chromium version and whether CISA KEV exploitation is tied to a specific browser build; check the Chromium release notes and the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["fully-patched-browsers","js-disabled"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000487,"input_tokens":2905,"output_tokens":393,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1646':16A,19A '-2016':15A,18A 'achiev':102B 'action':171C 'affect':151C 'allow':128C 'anoth':141C 'appli':172C 'array.prototype.concat':2A 'attack':95B,131C 'base':78B 'bound':85B,124C 'browser':60B,79B,99B,154C 'builtins.cc':5A 'canonical':27A,30A,33A 'caus':133C 'chrome':13A,37A,65B,164C 'chromium':21A,61B,77B,116C,157C 'chromium-bas':76B 'cisa':169C 'code':147C 'contain':119C 'could':150C 'craft':89B,145C 'crash':97B 'cve':14A,17A 'debian':23A,25A 'denial':135C 'desktop':47A 'edg':68B,166C 'engin':74B,118C 'enterprise':45A,49A,53A,57A 'eus':51A 'exploit':62B,111B 'googl':7A,12A,64B,115C,163C 'google':20A,36A 'google-chrom':63B 'hub':40A 'impact':105B,143C 'implement':3A 'includ':158C 'instruct':176C 'javascript':73B,146C 'leap':42A 'limit':161C 'linux':24A,26A,29A,32A,35A,46A,50A,54A,58A 'list':109B 'microsoft':67B,165C 'microsoft-edg':66B 'multipl':152C 'opensuse':41A,43A 'opera':69B,168C 'out-of-bound':82B,121C 'package':39A 'page':91B 'per':174C 'possibl':101B,139C 'read':86B,125C 'redhat':44A,48A,52A,56A 'remot':130C 'requir':170C 'runtim':70B 'server':55A 'servic':137C 'suse':38A 'trigger':93B 'ubuntu':28A,31A,34A 'unspecifi':104B,142C 'updat':173C 'use':10A 'util':156C 'v8':8A,22A,72B,117C 'vendor':175C 'via':144C 'vulner':126C,149C 'web':90B,153C 'wild':114B 'workstation':59A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-03-29T10:59:00+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-1646","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-1646","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"epss","external_id":"CVE-2016-1646","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-1646","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-1646","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1646","severity":null,"published_at":"2016-03-29T10:59:00+00:00","modified_at":"2026-06-17T00:42:19+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}